WordPress wpDiscuz Plugin <= 7.6.21 is vulnerable to Content Injection

Software wpDiscuz Type Plugin Vulnerable versions = 7.6.21 Fixed in 7.6.22 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-6704 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 32773981ccf8 Credits Tieu Pham Trong Nhan aptx4869 Required privilege...

golang: html/template: errors returned from MarshalJSON methods may break template escaping

A flaw was found in Go's html/template standard library package. If errors returned from MarshalJSON methods contain user-controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing subsequent actions to inject unexpected content into...

CVE-2024-41707

An issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data stor...

CVE-2024-41707

Archer Platform (v6) prior to 2024.06 is vulnerable to stored HTML content injection. Authenticated users can store malicious HTML in the trusted application data store, which is then executed by victim users’ browsers in the vulnerable app context. Remediation cited in available sources is to up...

CVE-2024-41707

An issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data stor...

CVE-2024-41707

An issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data stor...

WordPress Cooked Plugin <= 1.7.15.4 is vulnerable to Content Injection

Software Cooked Type Plugin Vulnerable versions = 1.7.15.4 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Content Injection CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 96527670dc1c Credits RE-ALTER Required privilege Contributor Published 18 July, 202...

WordPress WPCS Plugin <= 1.2.0.3 is vulnerable to Content Injection

Software WPCS Type Plugin Vulnerable versions = 1.2.0.3 Fixed in 1.2.0.4 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-38700 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2b3604018b32 Credits stealthcopter Required privilege Unauthenticat...

CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2...

CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2...

WordPress Photo Gallery by Ays Plugin < 5.7.1 is vulnerable to Content Injection

Software Photo Gallery by Ays Type Plugin Vulnerable versions 5.7.1 Fixed in 5.7.1 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-37442 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID 76b249292f10 Credits Ibnu Ubaeydillah Required privilege...

WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability

Content Injection vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin WooCommerce versions = 8.9.2...

WordPress WooCommerce Plugin <= 8.9.2 is vulnerable to Content Injection

Software WooCommerce Type Plugin Vulnerable versions = 8.9.2 Fixed in 9.0.0 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-35777 Patch priority Low CVSS severity Low 3.5 Developer Claim ownership PSID ab3d3030e73e Credits savphill Required privilege Shop manager Publishe...

CVE-2024-28984

Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Analyzer plugin interface...

CVE-2024-28983

Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.1.0.0 and 9.3.0.7, including 8.3.x allow a malicious URL to inject content into the Analyzer plugin interface...

CVE-2024-28984

CVE-2024-28984 affects Hitachi Vantara Pentaho Business Analytics Server prior to 10.1.0.0, 9.3.0.7, and the 8.3.x line. The issue is improper neutralization of input during web page generation in the Analyzer plugin interface, enabling a malicious URL to inject content. Impact described as Cross...

CVE-2024-28983

CVE-2024-28983 affects Hitachi Vantara Pentaho Business Analytics Server: prior to 10.1.0.0, 9.3.0.7, and 8.3.x, a malicious URL can inject content into the Analyzer plugin interface due to improper neutralization of input during web page generation (Cross-site Scripting). Impact is the ability t...

WordPress WP Directory Kit Plugin <= 1.3.6 is vulnerable to Content Injection

Software WP Directory Kit Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-37253 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID 2b9e3c80ffdc Credits Sandeep Vishwakarma from eSec Forte...

3h1-ui (>=2.14.41, <=3.0.0-next.266), @abt-desk/apm (>=0.0.1, <=0.33.12) +1871 more potentially affected by CVE-2024-38356 via tinymce (>=5.0.6, <=5.10.9)

tinymce NPM version =5.0.6, =2.14.41, =0.0.1, =0.1.0, =0.1.2, =0.3.7, =0.1.7, =0.1.0, =0.0.1, =0.2.0-0, =1.0.18-beta.8, =1.0.0, =1.2.3-beta.1, =0.1.1, =0.1.11 and more Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

PPOM for WooCommerce < 32.0.21 - Unauthenticated Content Injection Vulnerability

Description The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to Content Injection in all versions up to, and including, 32.0.20. This is due to the plugin not properly validating a field that can be updated. This makes it possible for unauthenticated attackers to...